Nowadays, you may meet such a confused situation: you might have noticed a notification that the Windows Presentation Foundation plugin was disabled to protect the user and the web browser when you open your Firefox browser.

Yes, many users who received the message were a bit puzzled as they did not install the plugin in first place. Remember the Microsoft .net Framework Assistant incident earlier this year when Microsoft installed the plugin in the Firefox web browser without notifying the user? The installation of the Windows Presentation Foundation plugin is basically the same deal.

The Windows Presentation Foundation Plugin gets installed when the Microsoft .net Framework 3.5 SP1 gets installed in the Windows operating system. Users who noticed the installation also noticed that they were not able to uninstall the plugin, only disable it in the Firefox plugin manager.

Mozilla today blacklisted the Windows Presentation Foundation Plugin. Not because of the silent install but because of a security vulnerability, or to be precise a remote code execution vulnerability. The vulnerability was reported on October 16 and measures to block the plugin were initiated today. Interested users can read up on the vulnerability at the Bug listing at the Mozilla website.

This raises several interesting questions. Could Microsoft be held accountable if computer systems are successfully attacked? Microsoft is not the only developer that is adding plugins to Firefox without asking the user. The Mozilla developers should consider implementing a security control to block unwanted plugins from being installed. Users who have not received the message in Firefox yet should check in the plugin section if the plugin is installed and if it is enabled or disabled. It should be disabled immediately if it is not already.

Related Posts